Privileged access management (PAM)
PAM · privileged access management · bastion host · jump server · privileged accounts · password vault · PIM
A set of controls that restricts, records and limits the use of the most powerful accounts (administrators, service accounts, emergency access), which are attackers’ favourite targets.
In practice
A PAM solution keeps administrator passwords in a vault, rotates them automatically and only releases them at the moment of use, often through a bastion that records sessions. Rights can be granted “just in time” for a specific job and then withdrawn. ANSSI, the French national cybersecurity agency, recommends administering systems from dedicated workstations, with accounts separate from office accounts. Providers who manage your systems remotely must go through the same controlled route.
Fictional case: a managed service provider connected to an SME’s servers with a shared administrator account whose password had not changed in six years. With a bastion, every intervention is now named, time-limited and recorded, and the password changes after each use.
How to protect yourself
- Inventory every privileged account, including those used by providers.
- Route administration through a bastion with MFA and session recording.
- Administer from dedicated workstations with no email or web browsing.
